Description

luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json grants rpcd file.exec permission for the general shell interpreter /bin/sh. An authenticated delegated session with that read ACL can supply caller-controlled params; rpcd authorizes the executable path and passes those arguments to the shell, allowing arbitrary commands to execute as root. Builds without the /bin/sh exec grant, including the checked openwrt-24.10 and openwrt-23.05 branches, are not affected by this specific chain. This vulnerability is fixed in 1.1.2-6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-21T20:17:26.670Z",
  "pubdate": "2026-09-21T20:17:26.670Z",
  "executiveSummary": "The luci-app-advanced-reboot package for OpenWrt contains a critical security flaw involving improper access control configuration within its RPC daemon (rpcd) access control lists (ACLs).\nThe vulnerability is classified as an improper privilege management issue, where the application grants the authenticated user session excessive permissions to execute system-level binaries.\nSpecifically, the ACL configuration permits the execution of the general shell interpreter '/bin/sh' via the rpcd interface. An attacker possessing an authenticated delegated session can abuse this permission to supply arbitrary, caller-controlled parameters to the shell interpreter.\nBecause the rpcd service operates with elevated privileges, this flaw allows for arbitrary command execution as the root user. The impact is a complete system compromise, enabling an attacker to gain full control over the router's operating system, modify configurations, install persistence mechanisms, or pivot into the underlying network.\nThe vulnerability affects versions of luci-app-advanced-reboot prior to 1.1.2-6. Exploitation requires an active, authenticated session, though the delegated nature of such sessions increases the risk surface. The issue is resolved by removing the specific 'file.exec' grant for '/bin/sh' within the affected ACL definition files.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper definition of access control permissions within 'applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json'. The ACL definition explicitly granted the rpcd 'file.exec' permission to the '/bin/sh' utility.\nThe OpenWrt rpcd subsystem provides a framework for remote procedure calls, which are used by the LuCI web interface to interact with the system backend. When an ACL grants execution rights to a binary, the rpcd daemon verifies the path and executes the command with the privileges of the service.\nThe exploitation flow begins with an attacker obtaining an authenticated session with delegated access rights. By crafting a malicious request directed at the rpcd interface, the attacker invokes the '/bin/sh' binary authorized by the vulnerable ACL. Because the interface allows for caller-controlled parameters to be passed to the executed executable, the attacker can supply shell commands as arguments to '/bin/sh'.\nUpon receiving the request, the rpcd daemon validates that the path '/bin/sh' is within the permitted execution list defined in the ACL. Once validated, the daemon executes the shell interpreter with the attacker's supplied command string as an argument. Since the daemon runs with root privileges, the injected command is executed in the context of the root user, effectively bypassing standard restrictions.\nThis vulnerability effectively elevates the privileges of an authenticated delegated user to those of the system administrator. The attacker can execute any command permissible by the shell, facilitating full arbitrary code execution. This allows for the modification of system binaries, exfiltration of sensitive configuration data, or the disruption of network services. The scope of the attack is limited to the local system environment reachable through the LuCI/rpcd interface, but the post-exploitation impact is total system takeover.\nThe vulnerability is specific to builds that include the overly permissive ACL grant. Modern branches of OpenWrt, such as openwrt-24.10 and openwrt-23.05, are explicitly noted as unaffected because they do not include the dangerous '/bin/sh' exec grant in their current ACL configurations. The issue is specifically addressed in version 1.1.2-6 of the package, where the unnecessary execution permission for the shell interpreter has been revoked."
}